Innomerc One useful thing to do today
Do not scan unexpected urgent account messages.
More everyday safety lessonsChoose your depth. Learn at your own pace.
Understand it
A QR code is a way to carry information, often a website address. It does not certify who put it there. A sticker on a parking meter or a code in a message may send you somewhere unexpected.
Preview the destination when your phone offers it. If payment or sign-in is requested, use the official app or a known address when unsure. Check the payee and amount before approving a QR payment.
Under the hood
Decoding a QR image and opening its URL are separate steps. Risk depends on the destination and subsequent actions: a fake form, a download or an authorization request. A QR login approval may connect someone else’s session, not simply display a page.
Practitioner perspective
Support clear destination previews, trusted payment identities and explicit login-device confirmation. Investigations should capture where the code was placed and its decoded destination without opening it on a normal work device. A redirect can change the final destination.
Phishing
A QR code is a way to carry information, often a website address. It does not certify who put it there. A sticker on a parking meter or a code in a message may send you somewhere unexpected.
Illustrated analogy · Select the image to enlargeWatch it work
A fictional, simplified model. Select a component to inspect it, or follow the steps in order.
A familiar-looking page can be the wrong page
Compare entering a secret with returning to the real service. This models information flow, not a real attack.
The design of a page does not prove who will receive the information.
How to use this example
Select Next step to read at your own pace, or Animate step to watch one exchange. Nothing advances until you choose.
What it means
Everyday example
State in this scenario
Inspect components & read every step
- You
The person making the decision in this fictional example.
Example: You decide whether to share information, approve a request or check it first.
- Fake page
A page impersonating a legitimate service.
Example: A copied sign-in page can send your entered password to a scammer.
- Scammer
A person using deception to obtain money, information or access.
Example: They send a misleading link and copy a familiar brand.
- Real service
The legitimate service you intended to use.
Example: You open its known app instead of following a suspicious message link.
Password entered
The design of a page does not prove who will receive the information.
- Fake page You: Sign in now. A lookalike page presents an urgent sign-in request.
- You Fake page: Password entered. The password is sent to the page you are using.
- Fake page Scammer: Secret copied. The scammer can receive the submitted information.
Real service opened
A known independent route avoids letting the message choose where you sign in.
- Fake page You: Urgent request. A page asks you to act immediately.
- You Real service: Known app. You open the service through your saved app or address.
- Real service You: Account status. Review whether the claimed problem exists in the real account.
Typed codes can be stolen too
Ordinary typed MFA codes can be relayed; MFA does not make a fake form safe.
- You Fake page: Typed code. A fake page also asks for a current sign-in code.
- Fake page Scammer: Code copied. The code can reach the scammer before it expires.
- Scammer Real service: Code used. The real service may accept a relayed code; site-bound passkeys work differently.
Fictional teaching trace. One moving dot represents an exchange, not a measured network capture.
Open the detailed lesson walkthrough
Explore the system
Scan
A sticker contains a different address.
Read every step without animation
Unverified sticker
- Scan. A sticker contains a different address.
- Fake form. A page asks for payment details.
- Information sent. The wrong destination receives them.
The physical location did not prove the code’s owner.
Destination checked
- Preview. Read the destination first.
- Official app. Open the intended provider yourself.
- Payment reviewed. Confirm the actual payee and amount.
Verify what you authorize, not just the code image.
What could go wrong
A replacement sticker leads a visitor from a real location to a fake checkout.
What you can do
- Do not scan unexpected urgent account messages.
- Verify the recipient independently before paying or approving a login.
Common mistakes
- A code in a real place is not automatically genuine.
- Merely decoding a code is not the same as entering secrets into its destination.
Check your understanding
Active recall: explain this idea in 30 seconds
A QR code is a way to carry information, often a website address. It does not certify who put it there. A sticker on a parking meter or a code in a message may send you somewhere unexpected.
Now give an example and name one limitation. Revisit the explanation if you get stuck.
Primary sources
Original explanations informed by these specifications and official resources. Source versions and lesson review are separate from product updates.
Content reviewed 2026-09-10. Read the editorial policy.